Every claim carries its own re-derivable proof — so agents, starting with code, build on facts they verify from first principles instead of sources they have to trust.
acsa.ai · nullius in verba — take nobody's word for it
A fact on the internet is something you trust. A fact in ACSA is something you re-derive. Every claim is a self-verifying Drop — a signature, its evidence, and a verdict any machine reproduces offline with nothing but the Python standard library. No API, no account, no install, no authority to capture.
verified ≠ true. A verdict proves a claim's provenance and that it faithfully quotes or executes its evidence — not that it is correct about the world. Opinions and failing checks come back
not_established, on purpose. That refusal is the point.
ACSA is a stack of three keyless protocols, each giving the network one property a self-sustaining knowledge substrate needs:
| Protocol | Property | What it does |
|---|---|---|
| SAVA | self-verifying | one claim proves itself — Ed25519 over a canonical hash, grounded by a re-runnable check or a byte-exact quote |
| Confluence | self-preserving | trust computed from Sybil-hard independent evidence, so spam and attack can't move the signal |
| NT · Nullius Testimony | self-running | an open, keyless substrate — anyone lists a pond, nobody signs admission, no operator to capture |
flowchart LR
A["📝 Claim"] -->|"SAVA · sign + ground"| B["🔏 Drop<br/>self-verifying"]
B -->|"NT · pinned per-pond keys"| C["🌊 Keyless view<br/>no lake key"]
C -->|"Confluence · independent evidence"| D["📊 Trust-ranked facts<br/>spam sinks to 0"]
D -->|"agent builds only on result 0"| A
Don't take our word for it. Fetch the pinned verifier and a real check-grounded fact, and watch it re-derive on your machine:
curl -s https://acsa.ai/lake/sava_verify.py -o sava_verify.py
curl -s https://acsa.ai/lake/ponds/pyfacts.ponds.acsa.ai/drops/gauss-sum-1-100.json -o d.json
python3 sava_verify.py drop d.json \
--trust "$(curl -s https://acsa.ai/lake/ponds/pyfacts.ponds.acsa.ai/pubkey.hex)" \
--execute-checks --json
# → {"result": 0, "source_fidelity": "checked-by-execution", "verdict": "verified", "reasons": []}Change one byte of d.json and the seal breaks. That's the whole idea.
A Drop earns verified only if its evidence re-derives. There are two honest ways — and a claim with neither is declined, not stamped:
flowchart TD
C["A claim"] --> Q{"grounded how?"}
Q -->|"quote"| QV["byte-exact in a cited source<br/>→ checked-ok"]
Q -->|"check"| CV["a re-runnable snippet returns True<br/>→ checked-by-execution"]
Q -->|"neither"| NV["not_established<br/>opinions sink here, on purpose"]
Checks run in a locked-down sandbox and must be machine-stable — the same result on every machine, or they never verify.
No lake key. No operator index. The agent carries pinned per-pond keys and re-derives everything itself:
sequenceDiagram
participant Agent
participant acsa.ai
Agent->>acsa.ai: GET /lake/nt-bootstrap.json
Note over Agent: pinned {pond → pubkey}
Agent->>acsa.ai: GET each pond_head.json
Note over Agent: verify signature vs the PINNED key
Agent->>acsa.ai: GET manifest.json + drops
Note over Agent: reproduce the signed merkle_root —<br/>a host can't add, drop, or swap a claim
Note over Agent: Confluence-rank · build only on result 0
One line, if the engine is installed:
python -m acsa.nt https://acsa.ai/lake/nt-bootstrap.json --execute-checks| Repo | What |
|---|---|
| docs | start here to adopt — the pitch, a 5-minute quickstart, an integration guide, and a ready-to-fork demo pond |
| acsa | the engine — SAVA · Confluence · NT, the reference tools, and the tests that keep them honest |
| acsa-pond-template | fork-a-pond: stand up your own signed, cold-verifiable pond and join the lake |
| acsa-lake | the lake: pulls admitted ponds, grounded-verifies them, publishes a cold-verifiable surface |
| acsa-pond-teardown | a live pond: verified Ronin-bridge incident intelligence, every claim re-derivable |
→ acsa.ai · point your agent at it and watch it refuse anything that doesn't check out.